Complementos
Bienvenido a Complementos Thunderbird.
Añade funciones y estilos extra para hacer tu propio Thunderbird.
Cerrar¿Eres una persona dinámica?
Revisa nuestro sitio sobre complementos para dispositivos móviles.
Cerrar
mboxSleuth 1.0.0
por mboxsleuth
Forensic email analysis toolkit for mbox files.
24 modules: social graph, entity extraction, keyword search, evidence tagging, noise suppression, header analysis, attachment hashing, and more.
All processing is local.
Acerca de este complemento
mboxSleuth is a forensic email analysis dashboard for Thunderbird. It provides 24 analysis modules for forensics investigators reviewing mbox files, e-discovery practitioners, and security researchers.
All processing is local — no data ever leaves your machine.
Modules
Orientation & Mbox Management
Search & Discovery
Categorization
Identity & Anomaly Detection
Deep Forensics & Export
Evidence Tagging
Right-click messages in Thunderbird to tag as EVIDENCE or EVIDENCE - HOT. Works with multi-select. Export tagged messages as mbox files from the Export Data module.
Key Features</h3>
Privacy
mboxSleuth processes all data locally. No data is transmitted to external servers. No analytics or telemetry is collected.
Requirements
Thunderbird 115 or later.
All processing is local — no data ever leaves your machine.
Modules
Orientation & Mbox Management
- Overview — Account identification, message statistics, top correspondents, busiest days, top domains
- Modify Mbox — Split mbox files by date, size, or count. Noise suppression removes newsletters and automated messages
- Volume Timeline — Interactive D3.js chart of message volume over time (daily/weekly/monthly)
- Social Graph — Force-directed network graph with heatmap coloring, directional arrows, date filtering, zoom/pan, and PNG export
- Domain Analysis — Sender/recipient domains ranked by frequency. Flags freemail and unusual TLDs
- Sending Patterns — Classifies messages as 1-to-1, 1-to-few, or 1-to-many (broadcast)
Search & Discovery
- Time Analysis — 24x7 activity heatmap and timezone inference
- Keyword Search — Full-text search with regex, email address filtering, and Thunderbird Quick Filter integration
- Word Map — Word frequency analysis with clickable word cloud and rare-word discovery
- Entity Extractor — Extracts phone numbers, SSNs, credit cards, crypto wallets (BTC, ETH, XMR, LTC, DASH, ZEC, DOGE, USDT), tracking numbers (USPS, UPS, FedEx, DHL, international), IP addresses, physical addresses, and more
- URL Analyzer — Flags shortened links, cloud storage, file-sharing services, and domain mismatches
Categorization
- Account Notifications — Detects password resets, 2FA codes, login alerts, purchase receipts, shipping, bookings, and more. Editable keyword list
- Auto-Taint — Attorney-client privilege detection. Editable keywords, email address taint list. Export or delete flagged messages
- English Detector — Classifies messages as English, Non-English, or Mixed
- Language & Locale — Script detection, currency symbols, date formats, spelling patterns
Identity & Anomaly Detection
- Signature Blocks — Extracts phone numbers, titles, addresses, and URLs from email signatures
- Ghost Detector — Finds deleted messages from broken thread references
- Header Anomalies — Spoofing, SPF/DKIM/DMARC failures, missing headers, future dates
- Client Fingerprint — Email client identification and change detection
Deep Forensics & Export
- Tech Headers — Header statistics: routing analysis, mail server census, authentication summary, originating IPs
- Fingerprints — EXIF extraction with GPS coordinates and Google Maps links. PDF and Office document metadata
- Attachments — SHA-256 hashing with duplicate detection. Download all as ZIP with manifest
- Multimedia — Gallery of images, audio, and video with inline playback. Download all as ZIP
- Export Data — Timeline CSV, contact database, full message export, evidence mbox export
Evidence Tagging
Right-click messages in Thunderbird to tag as EVIDENCE or EVIDENCE - HOT. Works with multi-select. Export tagged messages as mbox files from the Export Data module.
Key Features</h3>
- 24 analysis modules in a single dashboard
- Multi-folder and multi-account scanning
- CSV export on every module
- Thunderbird Quick Filter integration
- Paginated tables for large datasets
- Shared API cache for performance
- Dark mode
- All libraries bundled locally (D3.js, exif-js, JSZip)
Privacy
mboxSleuth processes all data locally. No data is transmitted to external servers. No analytics or telemetry is collected.
Requirements
Thunderbird 115 or later.
